Secure storage is becoming increasingly common as corporations move towards storing data primarily in electronic form. Unlike paper documents (i.e., “hard copies”), electronic documents are harder to secure and thus easily compromised. To address this issue, there has been an increasing interest in secure storage schemes. One such secure storage scheme that is commonly used is the Transparent Cryptographic File System (TCFS).
TCFS is a cryptographic distributed file system that is implemented on the architecture provided by the Network File System (NFS®) developed by Sun Microsystems, Inc. (NFS is a registered trademark of Sun Microsystems, Inc., Calif., USA). NFS has become commonly-used in distributed computing; allowing data to be accessed from a common file repository from any machine connected directly or remotely to the common file repository. Within this context, a number of security issues arise, such as unauthorized users gaining access to restricted services, etc. To prevent this from happening, the TCFS protects data at the system level.
In the TCFS scheme, data is stored in a secure server in encrypted form. When a client application requests data stored in the secure server, a request is sent to the secure server to retrieve a block of data, e.g., one or more files, corresponding to the request. The block of data is then transmitted to the client. A client kernel, running on the client, decrypts the block of encrypted data and then passes the decrypted block of data to the client application. When a request is generated by the client application to save the block of data back to the secure server, the client kernel encrypts the data and sends it back to the secure server, where the block of data is stored in encrypted form. Using this scheme, TCFS requires the client application and user to trust the client kernel that accesses the file system.
FIG. 1 shows a flow diagram that details the typical method of encrypting the blocks of data on the secure server using TCFS. Initially, a master key (100) is generated for each user, and a file key (104) is generated for each file or set of files. The file key(s) (104) is subsequently encrypted using a decryption algorithm (D) (106) and the master key (100) with the result being stored in a file header (102). The block number (108) of the block of data is then obtained and concatenated with the file key (104). The result of the concatenation is hashed using a hashing algorithm (110) to obtain a block key (112). The block data (114) is then encrypted using the block key (112) and an encryption algorithm (E) (116) to obtain an encrypted block (118). The block data (114) concatenated with the block key (112) is also hashed using a hashing algorithm (120) to generate an authentication tag (122). To obtain the data once it has been encrypted using the scheme described in FIG. 1, a user requests a specific block number (108) and have either the file key (104) or the master key (100).
The TCFS scheme described above also includes functionality to enable threshold sharing of files among users. Threshold sharing includes specifying a minimum number of members (i.e., the “threshold”) that need to be “active” for the files owned by the group to become available. TCFS enforces the threshold sharing by generating a group encryption key for each group and giving each member of the group a share using a Threshold Secret Sharing Scheme (i.e., a portion of the group encryption key). The group encryption key can be reconstructed by any set of keys as long as the number of keys in the set is at least equal to the threshold.
A member of the group that intends to become active does so by pushing his/her share of the group key into the kernel. The TCFS module checks whether the number of shares available is above the threshold. If the number of shares is above the threshold, then the TCFS module reconstructs the group encryption key. Based on the properties of the Threshold Secret Sharing Scheme, if enough shares are available, the group encryption key is guaranteed to be correctly reconstructed.
Once the group encryption key has been reconstructed, the files owned by the group become accessible. Each time a member decides to become inactive, his/her share of the group encryption key is removed. The TCFS module checks whether the number of shares available is now less than the threshold at regular intervals. In this case, the group encryption key is removed from the TCFS module triggering files owned by the group to become inaccessible.
This TCFS implementation of the group sharing facility requires each member to trust the client kernel, which hosts the TCFS module, of the-machine that reconstructs the key to actually remove the group encryption key once the number of active users goes below the threshold.